[Arch-TK]

The recommendation is not to interpolate certain things into shell scripts. Don't interpolate _anything_ into shell scripts as a rule. Use environment variables.

This combined with people having no clue how to write bash well/safely is a major source of security issues in these things.

[cedws]

Zizmor has a check for this.

https://github.com/woodruffw/zizmor